Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

Refine your search:

Exponential Smoothing Implementation in Splunk

0

Hi,

I am planning to implement exponential smoothing in Splunk based on below formula where s1 is the forecasted value. At time t=0, it is equal to first event. For time=t, it is calculated based on below formula. I can hard code value for "alpha".

s1=x0s{t}=[alpha * x{t-1}] + [(1-alpha)s{t-1}], t>1

For time=t, it is referring to previously calculated forecast value (s{t-1}) and previous event value (x{t-1}) so not sure how this can be achieved using Splunk.Say the log data is like below and "total" is the field which needs to be used(x{t}) to calcuate forecasted value(s{t}). I know there will be a field named "total" created which contains all the values but is there a way I can refer to say first value in field "total" like total[0] (as in arrays) which will be equal to 4, total[1] which will be equal to 6?

Thanks for the reply But my requirement is little different. This formula expects values from previous calculated results so I would like to know if there is a way I can refer to field values separately like arrays as specified in my question above.

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here. Closing this box indicates that you accept our Cookie Policy.